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Foreword 



rd , 



This Technical Specification (TS) has been produced by the 3 Generation Partnership Project (3GPP). 

The contents of the present document are subject to continuing work within the TSG and may change following formal 
TSG approval. Should the TSG modify the contents of the present document, it will be re-released by the TSG with an 
identifying change of release date and an increase in version number as follows: 

Version x.y.z 

where: 

x the first digit: 

1 presented to TSG for information; 

2 presented to TSG for approval; 

3 or greater indicates TSG approved document under change control. 

y the second digit is incremented for all changes of substance, i.e. technical enhancements, corrections, 
updates, etc. 

z the third digit is incremented when editorial only changes have been incorporated in the document. 



Introduction 

This document has been prepared by the 3GPP Task Force, and contains an example set of algorithms which may be 
used as the authentication and key generation functions/7, fl*,f2,f3,f4,f5 and/5*. (It is not mandatory that the 
particular algorithms specified in this document are used — all seven functions are operator-specifiable rather than 
being fully standardised). This document is one five, which between them form the entire specification of the example 
algorithms, entitled: 

3GPP TS 35.205: "3rd Generation Partnership Project; Technical Specification Group Services and System 
Aspects; 3G Security; Specification of the MILENAGE Algorithm Set: An example algorithm set for the 3GPP 
authentication and key generation functions fl, fl*, f2, G, f4, f5 and f5*; 
Document 1: General". 

3GPP TS 35.206: "3rd Generation Partnership Project; Technical Specification Group Services and System 
Aspects; 3G Security; Specification of the MILENAGE Algorithm Set: An example algorithm set for the 3GPP 
authentication and key generation functions fl, fl*, f2, G, f4, f5 and f5*; 
Document 2: Algorithm Specification". 

3GPP TS 35.207: "3rd Generation Partnership Project; Technical Specification Group Services and System 
Aspects; 3G Security; Specification of the MILENAGE Algorithm Set: An example algorithm set for the 3GPP 
authentication and key generation functions fl, fl*, f2, G, f4, f5 and f5*; 
Document 3: Implementors' Test Data". 

- 3GPP TS 35.208: "3rd Generation Partnership Project; Technical Specification Group Services and System 
Aspects; 3G Security; Specification of the MILENAGE Algorithm Set: An example algorithm set for the 3GPP 
authentication and key generation functions fl, fl*, f2, G, f4, f5 and f5*; 
Document 4: Design Conformance Test Data". 

3GPP TR 35.909: "3rd Generation Partnership Project; Technical Specification Group Services and System 
Aspects; 3G Security; Specification of the MILENAGE Algorithm Set: An example algorithm set for the 3GPP 
authentication and key generation functions fl, fl*, f2, G, f4, f5 and f5*; 
Document 5: Summary and results of design and evaluation". 
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The name "MILENAGE" 



The name of this algorithm set is "MILENAGE". It should be pronounced like a French word — something like "mi- 
le-nahj". 



Outline of the document 



Section 2 introduces the algorithms and describes the notation used in the subsequent sections. 

Section 3 explains how the algorithms are designed as a framework in such a way that various "customising 
components" can be selected in order to customise the algorithm for a particular operator. 

Section 4 defines the example algorithms. The algorithm framework is defined in section 4.1; in section 4.2, specific 
instances of the components are selected to define the specific example algorithm set. 

Section 5 explains various options and considerations for implementation of the algorithms, including considerations to 
be borne in mind when modifying the customising components. 

Illustrative pictures are given in Annex 1 . Annex 2 gives a specification of the block cipher algorithm which is used as a 
cryptographic kernel in the definition of the example algorithms. Annexes 3 and 4 contain source code in the C 
programming language: Annex 3 gives a complete and straightforward implementation of the algorithm set, while 
Annex 4 gives an example of an alternative high-performance implementation just of the kernel function. 

1.1 References 

The following documents contain provisions which, through reference in this text, constitute provisions of the present 
document. 

• References are either specific (identified by date of publication, edition number, version number, etc.) or 
non-specific. 

• For a specific reference, subsequent revisions do not apply. 

• For a non-specific reference, the latest version applies. In the case of a reference to a 3GPP document (including 
a GSM document), a non-specific reference implicitly refers to the latest version of that document in the same 
Release as the present document. 

[1] 3GPP TS 33.102 v3.5.0: "3rd Generation Partnership Project; Technical Specification Group 

Services and System Aspects; 3G Security; Security Architecture". 

[2] 3GPP TS 33.105 v3.4.0: "3rd Generation Partnership Project; Technical Specification Group 

Services and System Aspects; 3G Security; Cryptographic Algorithm Requirements". 

[3] 3GPP TS 35.206: "3rd Generation Partnership Project; Technical Specification Group Services 

and System Aspects; 3G Security; Specification of the MILENAGE Algorithm Set: An example 
algorithm set for the 3GPP authentication and key generation functions fl, fl*, f2, f3, f4, f5 and 
f5*; Document 2: Algorithm Specification" (this document). 

[4] 3GPP TS 35.207: "3rd Generation Partnership Project; Technical Specification Group Services 

and System Aspects; 3G Security; Specification of the MILENAGE Algorithm Set: An example 
algorithm set for the 3GPP authentication and key generation functions fl, fl*, f2, f3, f4, f5 and 
f5*; Document 3: Implementors' Test Data". 

[5] 3GPP TS 35.208: "3rd Generation Partnership Project; Technical Specification Group Services 

and System Aspects; 3G Security; Specification of the MILENAGE Algorithm Set: An example 
algorithm set for the 3GPP authentication and key generation functions fl, fl*, f2, f3, f4, f5 and 
f5*; Document 4: Design Conformance Test Data". 
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[6] Joan Daemen and Vincent Rijmen: "AES Proposal: Rijndael", available at 

http://csrc.nist.gov/encryption/aes/round2/AESAlgs/Riindael/Riindael.pdf or 
http://www.esat.kuleuven.ac.be/~riimen/riindael/riindaeldocV2.zip 

[7] http://csrc.nist.gov/encryption/aes/ 

[8] Thomas S. Messerges, "Securing the AES finalists against Power Analysis Attacks", in FSE 2000, 

Seventh Fast Software Encryption Workshop, ed. Schneier, Springer Verlag, 2000. 

[9] P. C. Kocher, "Timing Attacks on Implementations of Diffie-Hellman, RS A, DSS, and Other 

Systems", in CRYPTO'96, Lecture Notes in Computer Science #1 109, Springer Verlag, 1996. 

[10] J. Kelsey, B. Schneier, D. Wagner, C. Hall, "Side Channel Cryptanalysis of Product Ciphers", in 

ESORICS'98, Lecture Notes in Computer Science #1485, Springer Verlag, 1998. 

[11] L. Goubin, J. Patarin, "DES and differential power analysis", in CHES'99, Lecture Notes in 

Computer Science #1717, Springer Verlag, 1999. 

[12] P. Kocher, J. Jaffe, B. Jun, "Differential Power Analysis", in CRYPTO'99, Lecture Notes in 

Computer Science #1666, Springer Verlag, 1999. 

[13] L. Goubin, J.-S. Coron, "On boolean and arithmetic masking against differential power analysis", 

in CHES'OO, Lecture Notes in Computer Science series, Springer Verlag (to appear). 



2 INTRODUCTORY INFORMATION 

2.1 Introduction 

Within the security architecture of the 3GPP system there are seven security functions fl , fl* , J2 , j 3 , f4, j 5 and/5*. 
The operation of these functions falls within the domain of one operator, and the functions are therefore to be specified 
by each operator rather than being fully standardised. The algorithms specified in this document are examples that may 
be used by an operator who does not wish to design his own. 

The inputs and outputs of all seven algorithms are defined in section 2.4. 

2.2 Notation 

2.2.1 Radix 

We use the prefix Ox to indicate hexadecimal numbers. 

2.2.2 Conventions 

We use the assignment operator '=', as used in several programming languages. When we write 

<variable> = <expression> 
we mean that <variable> assumes the value that <expression> had before the assignment took place. For instance, 

x = x + y + 3 
means 

(new value of x) becomes (old value of x) + (old value of y) + 3. 

2.2.3 Bit/Byte ordering 

All data variables in this specification are presented with the most significant bit (or byte) on the left hand side and the 
least significant bit (or byte) on the right hand side. Where a variable is broken down into a number of substrings, the 
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leftmost (most significant) substring is numbered 0, the next most significant is numbered 1, and so on through to the 
least significant. 



2.2.4 List of Symbols 



© 
ii 

E[x] k 
rot(x,r) 



X[i] 



The assignment operator. 

The bitwise exclusive-OR operation 

The concatenation of the two operands. 

The result of applying a block cipher encryption to the input value x using the key k. 

The result of cyclically rotating the 128-bit value x by r bit positions towards the most significant 

bit. If x = x[0] II x[l] II . . . x[127], and y = rot(x,r), 

then y = x[r] II x[r+l] II ... x[127] II x[0] II x[l] II x[r-l]. 



The i m bit of the variable X. (X = X[0] II X[l] II X[2] 



). 



2.3 



List of Variables 



AK a 48-bit anonymity key that is the output of either of the functions/5 and/5*. 

AMF a 16-bit authentication management field that is an input to the functions/7 and/7*. 

cl,c2,c3,c4,c5 128-bit constants, which are XORed onto intermediate variables. 

CK a 128-bit confidentiality key that is the output of the function/3. 

IK a 128-bit integrity key that is the output of the function/4. 

INI a 128-bit value constructed from SQN and AMF and used in the computation of the functions/7 

and/7*. 

a 128-bit subscriber key that is an input to the functions/7, fl*,f2,f3,f4,f5 and/5*. 

a 64-bit network authentication code that is the output of the function/7. 

a 64-bit resynchronisation authentication code that is the output of the function/7*. 

a 128-bit Operator Variant Algorithm Configuration Field that is a component of the functions /7, 

/7*,y2,/3,/4,/5 and/5*. 

a 128-bit value derived from OP and K and used within the computation of the functions. 
OUT 1 ,OUT2,OUT3,OUT4,OUT5 

128-bit computed values from which the outputs of the functions/7, fl*,f2,f3,f4,f5 and/5* are 

obtained. 
rl,r2,r3,r4,r5 integers in the range 0-127 inclusive, which define amounts by which intermediate variables are 

cyclically rotated. 
RAND a 128-bit random challenge that is an input to the functions/7, fl*,f2,f3,f4,f5 and/5*. 

RES a 64-bit signed response that is the output of the function/2. 

SQN a 48-bit sequence number that is an input to either of the functions/7 and/7*. (For/7* this input 

is more precisely called SQN M s) 
TEMP a 128-bit value used within the computation of the functions. 



K 

MAC-A 
MAC-S 
OP 

OPr 



2.4 Algorithm Inputs and Outputs 

The inputs to the algorithms are given in tables 1 and 2, the outputs in tables 3-9 below. 

Table 1 : inputs to 11 and 11* 



Parameter 


Size (bits) 


Comment 


K 


128 


Subscriber key K[0]...K[127] 


RAND 


128 


Random challenge RAND[0]...RAND[127] 


SQN 


48 


Sequence number SQN[0]...SQN[47]. (For ft'this input is 
more precisely called SQNms-) 


AMF 


16 


Authentication management field AMF[0]...AMF[15] 



Table 2: inputs to 12, 13, 14, /5and 15* 



Parameter 


Size (bits) 


Comment 


K 


128 


Subscriber key K[0]...K[127] 


RAND 


128 


Random challenge RAND[0]...RAND[127] 
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Table 3: 11 output 



Parameter 


Size (bits) 


Comment 


MAC-A 


64 


Network authentication code MAC-A[0] . . . 


MAC-A[63] 


Table 4: 11* output 


Parameter 


Size (bits) 


Comment 


MAC-S 


64 


Resynch authentication code MAC-S[0].. 


MAC-S[63l 


Tables. 12 output 


Parameter 


Size (bits) 


Comment 


RES 


64 


Response RES[0]...RES[63] 


Table 6. 13 output 


Parameter 


Size (bits) 


Comment 


CK 


128 


Confidentiality key CK[0]...CK[127] 


Table 7. 14 output 


Parameter 


Size (bits) 


Comment 


IK 


128 


Integrity key IK[0]...IK[127] 


Table 8. f5 output 


Parameter 


Size (bits) 


Comment 


AK 


48 


Anonymity key AK[0]...AK[47] 


Table 9. 15* output 


Parameter 


Size (bits) 


Comment 


AK 


48 


Resynch anonymity key AK[0]...AK[47l 



Note: Both f5 and f5* outputs are called AK according to reference [2]. In practice only one of them will be calculated 
in each instance of the authentication and key agreement procedure. 



3 The algorithm framework and the specific example 

algorithms 

The example algorithm set makes use of the following components: 

A block cipher encryption function, which takes a 128-bit input and a 128-bit key and returns a 128-bit output. 
If the input is x, the key is k and the output is y, we write y = E[x] k . 

A 128-bit value OP. This is an Operator Variant Algorithm Configuration Field, which the Task Force was 
asked to include as a simple means to provide separation between the functionality of the algorithms when used 
by different operators. It is left to each operator to select a value for OP. The algorithm set is designed to be 
secure whether or not OP is publicly known; however, operators may see some advantage in keeping their value 
of OP secret. This and other aspects of the use of OP are discussed further in section 5. 

In the specific example algorithm set, a particular block cipher is used. But the algorithms have been designed so that 
this component can be replaced by any operator who wishes to create his own customised algorithm set. In that sense 
this document defines an algorithm framework, and the example algorithm set is one that fits within the framework. 
This is how the algorithm set is defined in section 4: in section 4. 1 the framework is defined in terms of the block 
cipher, and then in section 4.2 a block cipher is selected to give a fully specified algorithm set. 
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Definition of the example algorithms 



4.1 Algorithm Framework 

A 128-bit value OPc is derived from OP and K as follows: 

op c = op e e[op] k 

An intermediate 128-bit value TEMP is computed as follows: 

TEMP = E[RAND OP c ] K 

A 128-bit value INI is constructed as follows: 
IN1[0] .. INI [47] = SQN[0] .. SQN[47] 
IN1[48] .. IN1[63] = AMF[0] .. AMF[15] 
INI [64] .. IN1[1 1 1] = SQN[0] .. SQN[47] 
IN1[1 12] .. INI [127] = AMF[0] .. AMF[15] 

Five 128-bit constants cl, c2, c3, c4, c5 are defined as follows: 

cl[i] = 0for0<i<127 

c2[i] = for < i < 127, except that c2[127] = 1 
c3[i] = for < i < 127, except that c3[126] = 1 
c4[i] = for < i < 127, except that c4[125] = 1 
c5[i] = for < i < 127, except that c5[124] = 1 
Five integers rl, r2, r3, r4, r5 are defined as follows: 
rl = 64; r2 = 0; r3 = 32; r4 = 64; r5 = 96 

Five 128-bit blocks OUT1, OUT2, OUT3, OUT4, OUT5 are computed as follows: 

OUT1 = E[TEMP 8 rot(INl © OP c , rl) © cl] K © OP c 
OUT2 = E[rot(TEMP8 OP c , r2) c2] K © OP c 
OUT3 = E[rot(TEMP8 OP c , r3) © c3] K © OP c 
OUT4 = E[rot(TEMP8 OP c , r4) © c4] K © OP c 
OUT5 = E[rot(TEMP0 OP c , r5) c5] K © OP c 

The outputs of the various functions are then defined as follows: 

Output of/7 = MAC-A, where MAC-A[0] .. MAC-A[63] = OUT1[0] .. OUTl[63] 
Output of/7* = MAC-S, where MAC-S[0] .. MAC-S[63] = OUTl[64] .. OUTl[127] 
Output of/2 = RES, where RES[0] .. RES[63] = OUT2[64] .. OUT2[127] 
Output of/3 = CK, where CK[0] .. CK[127] = OUT3[0] .. OUT3[127] 
Output of/4 = IK, where IK[0] .. IK[127] = OUT4[0] .. OUT4[127] 
Output of/5 = AK, where AK[0] .. AK[47] = OUT2[0] .. OUT2[47] 
Output of/5* = AK, where AK[0] .. AK[47] = OUT5[0] .. OUT5[47] 

(The repeated reference to AK is not a mistake: AK is the name of the output of either /5 or/5*, and these two functions 
will not in practice be computed simultaneously.) 



4.2 Specific Example Algorithms 



The specific example algorithm set is defined by specifying the block cipher encryption function E[], which we do in 
this section. (It is left to each operator to specify the Operator Variant Algorithm Configuration Field OP.) 

The block cipher selected is Rijndael [6]. This is the algorithm proposed as the Advanced Encryption Standard [7]. 
More precisely, it is Rijndael with 128-bit key and 128-bit block size. 

E[x] k = the result of applying the Rijndael encryption algorithm 
to the 128-bit value x under the 128-bit key k. 
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Although the definitive specification of Rijndael is in [6], a complete specification of Rijndael with 128-bit key and 
128-bit block size is also given in Annex 2 of this document. 

The inputs to and output of Rijndael are defined as strings of bytes. The 128-bit string x = x[0] II x[l] II ... x[127] is 
treated as a string of bytes by taking x[0] II x[l] II ... x[7] as the first byte, x[8] II x[9] II ... x[15] as the second byte, and 
so on. The key and output string are converted in the same way. 

Note that the following patent statement has been made publicly (and included in [6]) by the authors of the Rijndael 
algorithm: "Rijndael or any of its implementations is not and will not be subject to patents." 



5 Implementation considerations 

5.1 OP c computed on or off the USIM? 

Recall that OP is an Operator Variant Algorithm Configuration Field. It is expected that each operator will define a 
value of OP which will then be used for all its subscribers. (It is up to operators to decide how to manage OP. The 
value of OP used for new batches of USIMs could be changed occasionally; or perhaps a different value could be given 
to each different USIM supplier. OP could even be given a different value for every subscriber if desired, but that is 
not really the intention.) 

It will be seen in section 4. 1 that OPc is computed from OP and K, and that it is only OPc, not OP, that is ever used in 
subsequent computations. This gives two alternative options for implementation of the algorithms on the USIM: 

(a) OPc computed off the USIM: OPc is computed as part of the USIM prepersonalisation process, and OPc is 
stored on the USIM. OP itself is not stored on the USIM. 

(b) OP c computed on the USIM: OP is stored on the USIM (it may be considered as a hard-coded part of the 
algorithm if preferred). OPc is recomputed each time the algorithms are called. 

The SAGE Task Force recommends that OPc be computed off the USIM if possible, since this gives the following 
benefits: 

The complexity of the algorithms run on the USIM is reduced. 

It is more likely that OP can be kept secret. (If OP is stored on the USIM, it only takes one USIM to be reverse 
engineered for OP to be discovered and published. But it should be difficult for someone who has discovered 
even a large number of (OPc, K) pairs to deduce OP. That means that the OPc associated with any other value 
of K will be unknown, which may make it harder to mount some kinds of cryptanalytic and forgery attacks. The 
algorithms are designed to be secure whether or not OP is known to the attacker, but a secret OP is one more 
hurdle in the attacker's path.) 

5.2 Customising the choice of block cipher 

It was explained in section 3 that an operator may create a variant algorithm set by selecting a block cipher other than 
Rijndael. It is vitally important that whatever block cipher is chosen is one that has been extensively analysed and is 
still believed to be secure. The security of the authentication and key generation functions is crucially dependent on the 
strength of the block cipher. 

Strictly speaking, in fact, the kernel function does not have to be a block cipher; it just has to be a keyed function (with 
128-bit input, key and output) satisfying the following cryptographic requirement: 

Let the key be fixed. Without initial knowledge of the key, but with a large number of pairs of chosen input and 
resulting output, it must be infeasible to determine the key, and also infeasible to predict the output for any other 
chosen input with probability significantly greater than 2" 128 . 

See also section 5.4 about protecting against side channel attacks; this will need to be borne in mind when 
selecting/implementing a replacement kernel function. 
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5.3 Further customisation 

If an operator wishes to customise the algorithms still further, a simple approach is to select different values for the 
constants cl-c5 and rl-r5. If this is done, the pairs (ci, ri) must all be different . It must not be the case that both ci = 
cj and ri = rj for i £ j. For instance, it must not be the case that both c2 = c4 and r2 = r4. Additionally it is 
recommended that the following restrictions are applied: 

cl has even parity. (A 128-bit value has even parity if the number of Ts in its binary representation is even.) 

c2-c5 all have odd parity. 

5.4 Resistance to side channel attacks 

When these algorithms are implemented on a USIM, consideration should be given to protecting them against side 
channel attacks such as differential power analysis (DP A). [8, 9, 10, 11, 12, 13] may be useful references. 
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Annex 1 : 

Figure of the Algorithms 
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Annex 2: 

Specification of the Block Cipher Algorithm Rijndael 



A2.1 Introduction 



This section provides a specification for the example kernel function. The block cipher used is Rijndael. The complete 
specification of Rijndael is given elsewhere [6], To quote from [6]: 

"Rijndael is an iterated block cipher with a variable block length and a variable key length. The block length and 
the key length can be independently specified to 128, 192 or 256 bits." 

For 3GPP purpose, Rijndael is used only in encryption mode and has the block and key length both set to 128 bits. For 
the rest of this section, when we refer to Rijndael we mean Rijndael with 128-bit block and key length. This document 
describes a simple byte oriented implementation of the encryption mode of Rijndael. Readers wishing more detail on 
the design of the cipher or implementation speed-ups are referred to the original document [6]. 



A2.2 The State and External Interfaces of Rijndael 

Rijndael is composed of a series of rounds that transform the input into the output. An intermediate result is called the 
State. The State can be pictured as a 4x4 rectangular array of bytes (128 bits in total). The Cipher Key is similarly 
pictured as a 4x4 rectangular array. These representations are illustrated in Figure 1 . 
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Figure 1 : Example of State and Cipher Key layout 

Rijndael takes plaintext bytes Po, Pi, . . .,Pis and key bytes Ko, Ki, . . .Ki 5 as input and ciphertext bytes Co, Ci, . . ., C15 as 
output. The plaintext bytes are mapped onto the state bytes in the order ao,o, ai,o, a2,o, &3,o, &o,i, ai,i, a2,i, 83,1,... and the 
key bytes in the order ko,o, ki^, k2,o, ^,0, ko,i, ki,i, k2,i, k3 ; i,.... At the end of the cipher operation, the ciphertext is 
extracted from the State by taking the State bytes in the same order. 

Hence if the one-dimensional index of a byte within a block is n and the two dimensional index is (i, j), we have: 

i = n mod 4; j = |_n/4j ; n = i + 4 * j 
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A2.3 Internal Structure 

Rijndael consists of the following operations: 
an initial Round Key addition 
9 rounds, numbered 1-9, each consisting of 

a byte substitution transformation 

a shift row transformation 

a mix column transformation 

a Round Key addition 
A final round (round 10) consisting of 

a byte substitution transformation 

a shift row transformation 

a Round Key addition 

The component transformations and how the Round Keys are derived from the cipher keys are specified in the 
following subsections. 

A2.4 The Byte Substitution Transformation 

The byte substitution transformation is a non-linear byte substitution, operating on each of the State bytes 
independently. The substitution table (S-box) is given in section A2.9. 

Figure 2 illustrates the effect of the byte substitution transformation on the State. 
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Figure 2: Byte substitution acts on the individual bytes of the State 

So, for every element of State, we apply the transformation: 

by = S-box[ a y ] 

Where ay is the initial value of the element in State, 
and by is the output value of the element in State. 
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A2.5 The Shift Row Transformation 

In the shift row transformation, the rows of the State are cyclically left shifted by different amounts. Row is not 
shifted, row 1 is shifted by 1 byte, row 2 by 2 bytes and row 3 by 3 bytes. 

Figure 3 illustrates the effect of the shift row transformation on the State. 
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Figure 3: Shift Row operates on the rows of the State 



A2.6 The Mix Column Transformation 

The mix column transformation operates on each column of the State independently. For column j, we have 

b 0J = T 2 (a 0J ) T 3 (aij) © a 2J © a 3J 
bj j = a 0J © T 2 (a, j) © T 3 (a 2J ) © a 3J 
b 2J = a 0J © aiJ © T 2 (a 2J ) © T 3 (a 3J ) 
b 3J = T 3 (a 0J ) © a 1%j © a 2J © T 2 (a 3J ) 



where: 



T 2 (a) = 2*a if a < 128 

or T 2 (a) = (2*a) © 283 if a > 128 
and T 3 (a) = T 2 (a) © a. 



For example: 



If a = 63 then T 2 (63) = 126; T 3 (63) = T 2 (63) © 63 = 65 

If a = 143 then T 2 (143) = 5; T 3 (143) = T 2 (143) © 143 = 138. 

Figure 4 illustrates the effect of the mix column transformation on the State. 
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Figure 4: Mix Column operates on the columns of the State 



A2.7 The Round Key addition 



In this operation, a Round Key is applied to the State by a simple bitwise exclusive-or. The Round Key is derived from 
the Cipher Key by means of the key schedule. The Round Key length is equal to the block length. 

This transformation is illustrated in Figure 5. 
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Figure 5: In the key addition the Round Key is bitwise XORed to the State 

So, for every element of State, we have: 



bjj = a y rk y 



Where ay is the initial value of the element in State, 

bjj is the output value of the element in State, and 
rkjj is the round key byte. 



A2.8 Key schedule 



Rijndael has 1 1 Round Keys, numbered 0-10, that are each 4x4 rectangular arrays of bytes. The Round Keys are 
derived from the Cipher Key by means of the key schedule. The initial Round Key (thought of as the zeroth Round 
Key) is formed directly from the cipher key. This zero" 1 Round Key is used unaltered for the initial key addition. The 
remaining Round Keys are used in the ten rounds. Each new round key is derived from the previous round key. Note: It 
is possible to run the key schedule round by round on an "as required" basis and so only use a total of 16 bytes to store 
the Round Key. 

Let rk r; y be the value of the r th Round Key at position (i, j ) in the array and ky be the cipher key loaded into a 4x4 
array. 

Intialisation: rko ; y = ky for all i and j. 
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The other Round Keys (r=l to 10 inclusive) are calculated from the previous one as follows. First the th column is 
constructed: 

rk r ,o,o = r k r .i,o,o © S-box[rk r .i ;1 3] © round_const[r] 
rk r; i,o = rk r .i 4j0 © S-box[rk r .i ;2 , 3 ] 
rk rj2 ,o = rk r .i, 2 ,o © S-box[rk r . 1A3 ] 
rk rA0 = rk r .i3 j0 © S-box[rk r .i )0;3 ] 

where round_const[l] = 1 and round_const[r] = T 2 (round_const[r-l]), and S-box is the previously mentioned byte 
substitution. 

Then the remaining three columns are constructed in turn from the corresponding column of the previous Round Key 
and the previous column of the current Round Key: 

rk r;i j = rk r . 1AJ © rk^.j for i=0, 1,2,3 and j= 1,2,3. 

Note: The ten round constants computed from the equations: 

round_const[1] = 1 

round_const[r] = T 2 (round_const[r-1]) r=2,3...,10 

are: 1, 2, 4, 8, 16, 32, 64, 128, 27, 54. 



A2.9 The Rijndael S-box 

Sbox[256] = { 

99,124,119,123,242,107,111,197, 48, 1,103, 43,254,215,171,118, 

202, 130, 201, 125, 250, 89, 71, 240, 173, 212, 162, 175, 156, 164, 114, 192, 

183,253,147, 38, 54, 63,247,204, 52,165,22 9,241,113,216, 49, 21, 

4,199, 35,195, 24,150, 5,154, 7, 18,128,22 6,235, 39,178,117, 

9,131, 44, 26, 27,110, 90,160, 82, 59,214,179, 41,227, 47,132, 

83,209, 0,237, 32,252,177, 91,10 6,203,190, 57, 74, 76, 88,207, 
208,239,170,251, 67, 77, 51,133, 69,249, 2,127, 80, 60,159,168, 

81,163, 64,143,146,157, 56,245,188,182,218, 33, 16,255,243,210, 

96,129, 79,220, 34, 42,144,136, 70,238,184, 20,222, 94, 11,219, 
224, 50, 58, 10, 73, 6, 36, 92,194,211,172, 98,145,149,228,121, 
231,200, 55,109,141,213, 78,169,108, 8 6,244,234,101,122,174, 8, 
186,120, 37, 46, 28,166,180,198,232,221,116, 31, 75,189,139,138, 
112, 62,181,102, 72, 3,246, 14, 97, 53, 87,185,134,193, 29,158, 
225,248,152, 17,105,217,142,148,155, 30,135,233,20 6, 85, 40,223, 
140,161,137, 13,191,230, 66,104, 65,153, 45, 15,176, 84,187, 22}; 
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Annex 3: 

Simulation Program Listing - Byte Oriented 



Example algorithms fl, fl*, f2, f3, f4, f5, f5* 



* A sample implementation of the example 3GPP authentication and 

* key agreement functions fl, fl*, f2, f3, f4, f5 and f 5* . This is 

* a byte-oriented implementation of the functions, and of the block 

* cipher kernel function Rijndael. 
* 

* This has been coded for clarity, not necessarily for efficiency. 
* 

* The functions f2, f3, f4 and f5 share the same inputs and have 

* been coded together as a single function. fl, fl* and f5* are 

* all coded separately. 

* * / 

typedef unsigned char u8; 



/* Operator Variant Algorithm Configuration Field 

/* Insert your value of OP here */ 

u8 0P[16] = (0x63, Oxbf, 0xa5, OxOe, 0xe6, 0x52, 0x33, 0x65, 
Oxff, 0x14, Oxcl, 0xf4, 0x5f, 0x88, 0x73, 0x7d}; 
/* Insert your value of OP here */ 



/* prototypes 



void fl ( u8 k[16], u8 rand[16], u8 sqn[6], u8 amf[2], 

u8 mac_a [8] ) ; 
void f2345 ( u8 k[16], u8 rand[16], 

u8 res[8], u8 ck[16], u8 ik[16], u8 ak[6] ); 
void flstar( u8 k[16], u8 rand[16], u8 sqn[6], u8 amf[2], 

u8 mac_s [8] ) ; 
void f5star( u8 k[16], u8 rand[16], 

u8 ak[6] ) ; 
void ComputeOPc ( u8 op_c[16] ) ; 
void Ri jndaelKeySchedule ( u8 key [16] ) ; 
void Ri jndaelEncrypt ( u8 input [16], u8 output [16] ); 



Algorithm fl 



* Computes network authentication code MAC-A from key K, random 

* challenge RAND, sequence number SQN and authentication management 

* field AMF. 



void fl ( u8 k[16], u8 rand[16], u8 sqn[6], u8 amf[2], 

u8 mac_a[8] ) 
{ 

u 8 op_c [16] ; 

u8 temp [16] ; 

u8 inl [16] ; 

u8 outl [16] ; 

u8 ri jndaellnput [ 1 6] ; 

u8 i; 



V 



Ri jndaelKeySchedule ( k ) ; 

ComputeOPc ( op_c ) ; 

for (i=0; i<16; i++) 

ri jndaellnput [i] = rand[i] A op_c[i]; 
Ri jndaelEncrypt ( ri jndaellnput, temp ) ; 
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for (i=0; i<6; i++) 
{ 

inl [i] = sqn [i] ; 

inl [i+8] = sqn[i] ; 
} 

for (i=0; i<2; i++) 
{ 

inl [i+6] = amf [i] ; 

inl [i+14] = amf [i] ; 
} 

/* XOR op_c and inl, rotate by rl=64, and XOR * 
* on the constant cl (which is all zeroes) */ 

for (i=0; i<16; i++) 

ri jndaellnput [ (i+8 ) % 16] = inl[i] A op_c[i]; 

/* XOR on the value temp computed before */ 

for (i=0; i<16; i++) 

ri jndaellnput [i] A = temp[i]; 

Ri jndaelEncrypt ( ri jndaellnput, outl ); 
for (i=0; i<16; i++) 
outl[i] A = op_c[i]; 

for (i=0; i<8; i++) 
mac_a[i] = outl[i]; 

return; 
} /* end of function fl */ 



Algorithms f2-f5 



* Takes key K and random challenge RAND, and returns response RES, 

* confidentiality key CK, integrity key IK and anonymity key AK. 



void f2345 ( u8 k[16], u8 rand[16], 

u8 res[8], u8 ck[16], u8 ik[16], u8 ak[6] ) 
{ 

u 8 op_c [16] ; 

u8 temp [16] ; 

u8 out [16] ; 

u8 ri jndaellnput [ 1 6] ; 

u8 i; 

Ri jndaelKeySchedule ( k ) ; 

ComputeOPc ( op_c ) ; 

for (i=0; i<16; i++) 

ri jndaellnput [i] = rand[i] A op_c[i]; 
Ri jndaelEncrypt ( ri jndaellnput, temp ) ; 

/* To obtain output block 0UT2 : XOR OPc and TEMP, * 

* rotate by r2=0, and XOR on the constant c2 (which * 

* is all zeroes except that the last bit is 1) . */ 

for (i=0; i<16; i++) 

ri jndaellnput [i] = temp[i] A op_c[i]; 
ri jndaellnput [ 15] A = 1; 

Ri jndaelEncrypt ( ri jndaellnput , out ) ; 
for (i=0; i<16; i++) 
out[i] A = op_c[i]; 

for (i=0; i<8; i++) 

res[i] = out [i+8]; 
for (i=0; i<6; i++) 

ak [i] = out [i] ; 

/* To obtain output block OUT3 : XOR OPc and TEMP, 
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* rotate by r3=32, and XOR on the constant c3 (which * 

* is all zeroes except that the next to last bit is 1) . */ 

for (i=0; i<16; i++) 

ri jndaellnput [ (i+12) % 16] = temp[i] A op_c[i]; 
ri jndaellnput [15] ~= 2; 

Ri jndaelEncrypt ( ri jndaellnput , out ); 
for (i=0; i<16; i++) 
out[i] ~= op_c[i]; 

for (i=0; i<16; i++) 
ck [i] = out [i] ; 

/* To obtain output block 0UT4 : XOR OPc and TEMP, * 

* rotate by r4=64, and XOR on the constant c4 (which * 

* is all zeroes except that the 2nd from last bit is 1) . */ 

for (i=0; i<16; i++) 

ri jndaellnput [ (i+8) % 16] = temp[i] A op_c[i]; 
ri jndaellnput [ 15] A = 4; 

Ri jndaelEncrypt ( ri jndaellnput , out ); 
for (i=0; i<16; i++) 
out[i] A = op_c[i]; 

for (i=0; i<16; i++) 
ik[i] = out [i] ; 

return; 
} /* end of function f2345 */ 



Algorithm fl* 



* Computes resynch authentication code MAC-S from key K, random 

* challenge RAND, sequence number SQN and authentication management 

* field AMF. 

* * / 

void flstar( u8 k[16], u8 rand[16], u8 sqn[6], u8 amf[2], 

u8 mac_s [8] ) 
{ 

u 8 op_c [16] ; 

u8 temp [16] ; 

u8 inl [16] ; 

u8 outl [16] ; 

u8 ri jndaellnput [ 1 6] ; 

u8 i; 

Ri jndaelKeySchedule ( k ); 

ComputeOPc ( op_c ) ; 

for (i=0; i<16; i++) 

ri jndaellnput [i] = rand[i] A op_c[i]; 
Ri jndaelEncrypt ( ri jndaellnput, temp ) ; 

for (i=0; i<6; i++) 
{ 

inl [i] = sqn [i] ; 

inl [i+8] = sqn[i] ; 
} 

for (i=0; i<2; i++) 
{ 

inl [i+6] = amf [i] ; 

inl [i+14] = amf [i] ; 
} 



/* XOR op_c and inl, rotate by rl=64, and XOR * 
* on the constant cl (which is all zeroes) * 

for (i=0; i<16; i++) 

ri jndaellnput [ (i+8 ) % 16] = inl[i] A op_c[i]; 
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/* XOR on the value temp computed before */ 

for (i=0; i<16; i++) 

ri jndaellnput [i] A = temp[i]; 

Ri jndaelEncrypt ( ri jndaellnput, outl ); 
for (i=0; i<16; i++) 
outl[i] "= op_c[i]; 

for (i=0; i<8; i++) 
mac_s[i] = outl[i+8]; 

return; 
} /* end of function flstar */ 



Algorithm f5* 



* Takes key K and random challenge RAND, and returns resynch 

* anonymity key AK . 



void f5star( u8 k[16], u8 rand[16], 

u8 ak[6] ) 
{ 

u 8 op_c [16] ; 

u8 temp [16] ; 

u8 out [16] ; 

u8 ri jndaellnput [ 1 6] ; 

u8 i; 

Ri jndaelKeySchedule ( k ); 

ComputeOPc ( op_c ) ; 

for (i=0; i<16; i++) 

ri jndaellnput [i] = rand[i] A op_c[i]; 
Ri jndaelEncrypt ( ri jndaellnput, temp ); 

/* To obtain output block 0UT5 : XOR OPc and TEMP, * 

* rotate by r5=96, and XOR on the constant c5 (which * 

* is all zeroes except that the 3rd from last bit is 1) . */ 

for (i=0; i<16; i++) 

ri jndaellnput [ (i+4) % 16] = temp[i] A op_c[i]; 
ri jndaellnput [ 15] A = 8; 

Ri jndaelEncrypt ( ri jndaellnput , out ) ; 
for (i=0; i<16; i++) 
out[i] A = op__c[i]; 

for (i=0; i<6; i++) 
ak [i] = out [i] ; 

return; 
} /* end of function f5star */ 



/* 

* Function to compute OPc from OP and K. Assumes key schedule has 

already been performed. 
* */ 

void ComputeOPc ( u8 op_c[16] ) 
{ 

u8 i; 

Ri jndaelEncrypt ( OP, op_c ); 
for (i=0; i<16; i++) 
op_c[i] A = OP [i] ; 

return; 
} /* end of function ComputeOPc */ 
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/* 

u8 roundKeys [11] [4] [4] ; 



Rijndael round subkeys 



-*/ 



/*— 

u8 S[ 

99, 1 

202, 1 

183,2 

4, 1 

9,1 

83,2 
208,2 

81,1 
205, 

96, 1 
224, 
231,2 
186, 1 
112, 
225,2 
140, 1 

}; 



Rijndael S box table 



-*/ 



256] = 
24, 119, 
30,201, 
53, 147, 
99, 35, 
31, 44, 
09, 0, 
39, 170, 
63, 64, 



12, 
29, 
50, 
00, 
20, 



19, 
79, 
58, 
55, 
37, 



62, 181, 
48, 152, 
61, 137, 



{ 

123, 

125, 

38, 
195, 

26, 
237, 
251, 
143, 
236, 
220, 

10, 
109, 

46, 
102, 

17, 

13, 



242, 

250, 

54, 

24, 

27, 

32, 

67, 

146, 

95, 

34, 

73, 

141, 

28, 

72, 

105, 

191, 



107, 

89, 

63, 

150, 

110, 

252, 

77, 

157, 

151, 

42, 

6, 

213, 

166, 

3, 

217, 

230, 



111, 
71, 

247, 

5, 

90, 

177, 
51, 
56, 
68, 

144, 
36, 
78, 

180, 

246, 

142, 
66, 



197, 
240, 
204, 
154, 
160, 

91, 
133, 
245, 

23, 
136, 

92, 
169, 
198, 

14, 
148, 
104, 



48, 
173, 

52, 
7, 

82, 
106, 

69, 
188, 
196, 

70, 
194, 
108, 
232, 

97, 
155, 

65, 



1, 

212, 

165, 

18, 

59, 

203, 

249, 

182, 

167, 

238, 

211, 

86, 

221, 

53, 

30, 

153, 



103, 
162, 
229, 
128, 
214, 
190, 
2, 
218, 
126, 
184, 
172, 
244, 
116, 

87, 
135, 

45, 



43, 

175, 

241, 

226, 

179, 

57, 

127, 

33, 

61, 

20, 

98, 

234, 

31, 

185, 

233, 

15, 



254,215, 

156, 164, 

113,216, 

235, 39, 

41,227, 

74, 76, 

80, 60, 

16,255, 

100, 93, 

222, 94, 

145, 149, 

101, 122, 

75, 189, 

134, 193, 

206, 85, 

176, 84, 



171, 118, 

114, 192, 

49, 21, 

178, 117, 

47, 132, 

88,207, 

159, 168, 

243,210, 

25, 115, 

11,219, 

228, 121, 

174, 8, 

139, 138, 

29, 158, 

40,223, 

187, 22, 



/* — 

u8 Xt 
0, 

32, 

64, 

96, 
128, 1 
160, 1 
192, 1 
224,2 

27, 

59, 

91, 
123, 1 
155, 1 
187, 1 
219,2 
251,2 



ime [ 

2, 
34, 
66, 

98,1 
30, 1 
62, 1 
94, 1 
26,2 
25, 
57, 
89, 
21, 1 
53, 1 
85, 1 
17,2 
49,2 



Thi 
256] 

4, 
36, 



array does the multiplication by x in GF(2 A 8) 
= { 



00, 1 
32, 1 
64, 1 
96, 1 
28,2 
31, 
63, 
95, 
27, 1 
59, 1 
91, 1 
23,2 
55,2 



8, 10, 12, 14, 16, 18, 20, 22, 24, 26, 28, 30, 
40, 42, 44, 46, 48, 50, 52, 54, 56, 58, 60, 62, 
72, 74, 76, 78, 80, 82, 84, 86, 88, 90, 92, 94, 
04, 106, 108, 110, 112, 114, 116, 118, 120, 122, 124, 126, 
36, 138, 140, 142, 144, 146, 148, 150, 152, 154, 156, 158, 
68, 170, 172, 174, 176, 178, 180, 182, 184, 186, 188, 190, 
00,202,204,206,208,210,212,214,216,218,220,222, 
32,234,236,238,240,242,244,246,248,250,252,254, 
19, 17, 23, 21, 11, 9, 15, 13, 3, 1, 7, 5, 
51, 49, 55, 53, 43, 41, 47, 45, 35, 33, 39, 37, 
83, 81, 87, 85, 75, 73, 79, 77, 67, 65, 71, 69, 
15,113,119,117,107,105,111,109, 99, 97,103,101, 
47, 145, 151, 149, 139, 137, 143, 141, 131, 129, 135, 133, 
79, 177, 183, 181, 171, 169, 175, 173, 163, 161, 167, 165, 
11, 209, 215, 213, 203, 201, 207, 205, 195, 193, 199, 197, 
43,241,247,245,235,233,239,237,227,225,231,229 



/*- 



* Rijndael key schedule function. Takes 16-byte key and creates 

* all Rijndael 's internal subkeys ready for encryption. 



void Ri jndaelKeySchedule ( u8 key [16] ) 
{ 

u8 roundConst; 

int i, j ; 

/* first round key equals key */ 
for (i=0; i<16; i++) 

roundKeys[0] [i & 0x03] [i>>2] = key[i] : 



roundConst 



1; 



/* now calculate round keys */ 

for (i=l; i<ll; i++) 

{ 

roundKeys[i] [0] [0] = S [roundKeys [i-1 ] 

A roundKeys [i-1] 

roundKeys [i] [1] [0] = S [roundKeys [i-1] 

A roundKeys [i-1] 

roundKeys [i] [2] [0] = S [roundKeys [i-1 ] 

A roundKeys [i-1] 

roundKeys [i] [3] [0] = S [roundKeys [i-1 ] 

A roundKeys [i-1] 



1] [3]] 




0] [0] " 


roundConst 


2] [3]] 




1 ] [ ] ; 




3] [3]] 




2 ] [ ] ; 




0] [3]] 




3] [0]; 





for (j=0; j<4; j++) 

{ 

roundKeys[i] [j] [1] = roundKeys [i-1] [j] [1] 

roundKeys[i] [ j] [2] = roundKeys [i-1 ][ j ] [2 ] 

roundKeys[i] [j] [3] = roundKeys [i-1 ] [j] [3] 



roundKeys [i] [j] [0'_ 
roundKeys [i] [j] [1[ 
roundKeys [i] [j] [2~ 
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/* update round constant */ 
roundConst = Xtime [roundConst] ; 



return; 
} /* end of function Ri jndaelKeySchedule */ 



/* Round key addition function */ 

void KeyAdd(u8 state[4][4], u8 roundKeys [ 11 ] [4 ] [ 4 ] , int round) 

{ 

int i, j; 

for (i=0; i<4; i++) 
for (j=0; j<4; j++) 

state [i] [ j ] "= roundKeys [round] [i] [ j] ; 

return; 



/* Byte substitution transformation */ 
int ByteSub(u8 state [4] [4]) 

{ 

int i, j; 

for (i=0; i<4; i++) 
for (j=0; j<4; j++) 

state[i][j] = S[state[i] [j] ] ; 

return 0; 



/* Row shift transformation */ 
void ShiftRow(u8 state[4][4]) 
{ 

u8 temp; 



/* left rotate row 1 by 1 */ 
temp = state [1] [0] ; 
state [1] [0] = state[l] [1] , 
state [1] [1] = state[l] [2] , 
state[l][2] = state[l][3], 
state [1] [3] = temp; 



/* left rotate row 2 by 2 
temp = state [2] [0]; 
state[2][0] = state[2][2]; 
state [2] [2] = temp; 
temp = state [2] [1]; 
state[2][l] = state[2][3]; 
state [2] [3] = temp; 



/ 



/* left rotate row 3 by 3 
temp = state [3] [0]; 
state [3] [0] = state[3][3] 
state [3] [3] = state [3] [2] 
state [3] [2] = state[3][l] 
state [3] [1] = temp; 



return; 



/* MixColumn transformation*/ 
void MixColumn (u8 state [4] [4]) 
{ 

u8 temp, tmp, tmpO; 

int i; 



/* do one column at a time */ 
for (i=0; i<4;i++) 

{ 

temp = state[0][i] A state[l][i] 
tmpO = state [0] [i] ; 



state[2][i] A state[3][i] 
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/* Xtime array does multiply by x in GF2 A 8 */ 
tmp = Xtime [state [0] [i] A state [ 1 ] [i] ] ; 
state [0] [i] A = temp " tmp; 

tmp = Xtime [state [1] [i] A state [2] [i] ] ; 
state [1] [i] A = temp A tmp; 

tmp = Xtime [state [2] [i] A state [3] [i] ] ; 
state [2] [i] A = temp A tmp; 

tmp = Xtime [state [3] [i] A tmpO]; 
state [3] [i] A = temp A tmp; 
} 

return; 
} 



/* 

* Rijndael encryption function. Takes 16-byte input and creates 

* 16-byte output (using round keys already derived from 16-byte 

* key) . 

* * / 

void Ri jndaelEncrypt ( u8 input [16], u8 output [16] ) 
{ 

u8 state [4] [4] ; 

int i, r; 

/* initialise state array from input byte string */ 
for (i=0; i<16; i++) 

state [i & 0x3] [i>>2] = input [i] ; 

/* add first round_key */ 
KeyAdd (state, roundKeys, 0); 

/* do lots of full rounds */ 

for (r=l; r<=9; r++) 

{ 

ByteSub (state) ; 

ShiftRow (state) ; 

MixColumn (state) ; 

KeyAdd (state, roundKeys, r) ; 
} 

/* final round */ 

ByteSub (state) ; 

ShiftRow (state) ; 

KeyAdd (state, roundKeys, r) ; 

/* produce output byte string from state array */ 

for (i=0; i<16; i++) 

{ 

output [i] = state [i & 0x3] [i»2]; 
} 

return; 
} /* end of function Ri jndaelEncrypt */ 
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Annex 4: 

Rijndael Listing - 32-Bit Word Oriented 



Ri jndael Implementation 



* A sample 32-bit orientated implementation of Rijndael, the 

* suggested kernel for the example 3GPP authentication and key 

* agreement functions. 

* This implementation draws on the description in section 5.2 of 

* the AES proposal and also on the implementation by 

* Dr B. R. Gladman <brg@gladman . uk . net> 9th October 2000. 

* It uses a number of large (4k) lookup tables to implement the 

* algorithm in an efficient manner. 
* 

* Note: in this implementation the State is stored in four 32-bit 

* words, one per column of the State, with the top byte of the 

* column being the _least_ significant byte of the word. 
* 

* * / 

#define LITTLE_ENDIAN /* For INTEL architecture */ 



typedef unsigned char u8; 
typedef unsigned int u32; 

/* Circular byte rotates of 32 bit values */ 

#define rotl (x) ( (x << 8) | (x >> 24)) 
#define rot2 (x) ( (x << 16) | (x >> 16)) 
#define rot3 (x) ( (x << 24) | (x >> 8)) 

/* Extract a byte from a 32-bit u32 */ 

#define byteO (x) (<u8) (x) ) 

#define bytel (x) ( (u8) (x >> 8)) 

#define byte2 (x) (<u8) (x >> 16)) 

#define byte3 (x) (<u8) (x >> 24)) 



/* Put or get a 32 bit u32 (v) in machine order from a byte * 
* address in (x) */ 

#ifdef LITTLE_ENDIAN 

#define u32_in(x) (*(u32*) (x) ) 
#define u32_put(x,y) (*(u32*) (x) = y) 

#else 

/* Invert byte order in a 32 bit variable */ 

__inline u32 byte_swap (const u32 x) 

return rotl (x) & OxOOffOOff | rot3 (x) & OxffOOffOO; 

inline u32 u32_in(const u8 x[]) 

return byte__swap ( * (u32* ) x) ; 

inline void u32_out (u8 x[], const u32 v) 

* (u32*) x = byte_swap (v) ; 

#endif 

/* The lookup tables */ 

static u32 rnd__con [10] = 
{ 
0x01, 0x02, 0x04, 0x08, 0x10, 0x2 0, 0x40, 0x80, OxlB, 0x3 6 
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}; 



static u32 

{ 
{ 

0xA56363C6 
0x50303060 
0x45CACA8F 
0xECADAD41 
0xC2B7B775 
0x5C343468 
0x0C040408 
0x0907070E 
0xlB090912 
0xF65252A4 
0xF55353A6 
0xBE6A6AD4 
0x6BD0D0BB 
0xCF45458A 
0xF35151A2 
0xDFBCBC63 
0x4CCDCD81 
0x57C4C493 
0xA06060C0 
0xCA46468C 
0x3BE0E0DB 
0x5DC2C29F 
0x32E7E7D5 
0xB46C6CD8 
0xD5BABA6F 
0x23E8E8CB 
0x907070E0 
0xA36161C2 
0x38E1E1D9 
0xB69B9B2D 
0x8F8C8C03 
0xC3414182 
}, 
{ 

0x6363C6A5 
0x30306050 
0xCACA8F4 5 
0xADAD41EC 
0xB7B775C2 
0x3434685C 
0x0404080C 
0x07070E09 
0x0909121B 
0x5252A4F6 
0x5353A6F5 
0x6A6AD4BE 
0xD0D0BB6B 
0x45458ACF 
0x5151A2F3 
0xBCBC63DF 
0xCDCD814C 
0xC4C49357 
0x6060C0A0 
0x46468CCA 
0xE0E0DB3B 
0xC2C29F5D 
0xE7E7D532 
0x6C6CD8B4 
0xBABA6FD5 
0xE8E8CB23 
0x7070E090 
0x6161C2A3 
0xE1E1D938 
0x9B9B2DB6 
0x8C8C038F 
0x414182C3 
}, 
{ 

0x63C6A563 
0x30605030 
0xCA8F45CA 
0xAD41ECAD 
0xB775C2B7 



ft_tab[4] [256] 



0x847C7CF8 
0x03010102 
0x9D82821F 
0x67D4D4B3 
OxlCFDFDEl 
0xF4A5A551 
0x52C7C795 
0x36121224 
0x9E83831D 
0x4D3B3B76 
0x68D1D1B9 
0x46CBCB8D 
0x2AEFEFC5 
0xl0F9F9E9 
0xFEA3A35D 
0xClB6B677 
0xl40C0C18 
0xF2A7A755 
0x98818119 
0x2 9EEEEC7 
0x56323264 
0x6ED3D3BD 
0x43C8C88B 
0xFA5 65 6AC 
0x887878F0 
0x7CDDDDAl 
0x423E3E7C 
0x5F35356A 
0xl3F8F8EB 
0x221ElE3C 
0xF8AlA159 
0xB0999929 



0x7C7CF884 
0x01010203 
0x82821F9D 
0xD4D4B367 
OxFDFDEllC 
0xA5A551F4 
0xC7C79552 
0x12122436 
0x83831D9E 
0x3B3B764D 
0xD1D1B968 
0xCBCB8D46 
0xEFEFC52A 
0xF9F9E910 
0xA3A35DFE 
0xB6B677Cl 
0x0C0C1814 
0xA7A755F2 
0x81811998 
0xEEEEC72 9 
0x32326456 
0xD3D3BD6E 
0xC8C88B43 
0x5656ACFA 
0x7878F088 
0xDDDDA17C 
0x3E3E7C42 
0x35356A5F 
0xF8F8EB13 
0xlElE3C22 
0xAlA159F8 
0x999929B0 



0x997777EE 
0xA96767CE 
0x40C9C989 
0xFDA2A25F 
0xAE93933D 
0x34E5E5Dl 
0x65232346 
0x9B80801B 
0x742C2C58 
0x61D6D6B7 
0000000000 
0xD9BEBE67 
0xE5AAAA4F 
0x06020204 
0xC0404080 
0x7 5DADAAF 
0x35131326 
0x827E7EFC 
0xD14F4F9E 
0xD3B8B86B 
0x4E3A3A74 
0xEFACAC4 3 
0x5937376E 
0x07F4F4F3 
0x6F25254A 
0x9C7474E8 
0xC4B5B571 
0xF95757AE 
0xB398982B 
0x92878715 
0x80898909 
0x772D2D5A 



0x7777EE99 
0x6767CEA9 
0xC9C98940 
0xA2A25FFD 
0x93933DAE 
0xE5E5D134 
0x23234665 
0x80801B9B 
0x2C2C5874 
0xD6D6B761 
0000000000 
0xBEBE67D9 
0xAAAA4FE5 
0x02020406 
0x404080C0 
0xDADAAF7 5 
0x13132635 
0x7E7EFC82 
0x4F4F9EDl 
0xB8B86BD3 
0x3A3A744E 
0xACAC43EF 
0x37376E59 
0xF4F4F307 
0x25254A6F 
0x7474E89C 
0xB5B571C4 
0x5757AEF9 
0x98982BB3 
0x87871592 
0x89890980 
0x2D2D5A77 



0x8D7B7BF6 
0x7D2B2B56 
0x877D7DFA 
0xEAAFAF45 
0x6A26264C 
0x08F1F1F9 
0x5EC3C39D 
0x3DE2E2DF 
0x2E1A1A34 
0xCEB3B37D 
0x2CEDEDCl 
0x4B393972 
0xl6FBFBED 
0x817F7FFE 
0x8A8F8F05 
0x63212142 
0x2FECECC3 
0x473D3D7A 
0x7FDCDCA3 
0x3C141428 
0xlE0A0A14 
0xA66262C4 
0xB76D6DDA 
0x25EAEACF 
0x722E2E5C 
0x211FlF3E 
0xAA6666CC 
0xD0B9B969 
0x33111122 
0x20E9E9C9 
0xl70D0DlA 
OxllOFOFlE 



0x7B7BF68D 
0x2B2B567D 
0x7D7DFA87 
OxAFAF45EA 
0x26264C6A 
0xF1F1F908 
OxC3C39D5E 
0xE2E2DF3D 
0xlAlA342E 
0xB3B37DCE 
0xEDEDC12C 
0x3939724B 
0xFBFBED16 
0x7F7FFE81 
0x8F8F058A 
0x21214263 
0xECECC32F 
Ox3D3D7A47 
OxDCDCA37F 
0xl414283C 
0x0A0A141E 
0x6262C4A6 
0x6D6DDAB7 
0xEAEACF25 
0x2E2E5C72 
0xlFlF3E21 
0x6666CCAA 
0xB9B969D0 
0x11112233 
0xE9E9C920 
OxODODlA17 
OxOFOFlEll 



OxODF2F2FF 
0xl9FEFEE7 
Oxl5FAFAEF 
0xBF9C9C23 
0x5A36366C 
0x937171E2 
0x28181830 
0x2 6EBEBCD 
0x2DlBlB36 
0x7B292952 
0x60202040 
0xDE4A4A94 
0xC5434386 
OxF05050AO 
0xAD92923F 
0x30101020 
OxE15F5FBE 
0xAC6464C8 
0x66222244 
0x7 9DEDEA7 
0xDB494992 
0xA8919139 
0x8C8D8D01 
0xAF6565CA 
0x241ClC38 
0xDD4B4B96 
0xD8484890 
0x91868617 
0xBB6969D2 
0x49CECE87 
0xDABFBF65 
0xCBB0B07B 



, 0xBD6B6BD6 
, Ox62D7D7B5 
, 0xEB5959B2 
, OxF7A4A453 
, 0x413F3F7E 
, 0x73D8D8AB 
, 0xA1969637 
, 0x6927274E 
, 0xB26E6EDC 
, 0x3EE3E3DD 
, OxlFFCFCE3 
, 0xD44C4C98 
, 0xD74D4D9A 
, 0x443C3C78 
, 0xBC9D9D21 
, OxlAFFFFE5 
, 0xA2979735 
, OxE75D5DBA 
, Ox7E2A2A54 
, OxE25E5EBC 
, 0x0A06060C 
, OxA4959531 
, Ox64D5D5Bl 
, 0x8E7A7AF4 
, 0xFlA6A657 
, 0xDCBDBD61 
, 0x05030306 
, 0x58ClC199 
, 0x70D9D9A9 
, OxFF5555AA 
, 0x31E6E6D7 
, 0xFC5454A8 



OxF2F2FFOD 
0xFEFEE719 
0xFAFAEF15 
0x9C9C23BF 
0x36366C5A 
0x7171E293 
0x18183028 
0xEBEBCD2 6 
0xlBlB362D 
0x2929527B 
0x20204060 
0x4A4A94DE 
0x434386C5 
Ox5050AOFO 
0x92923FAD 
0x10102030 
Ox5F5FBEEl 
0x6464C8AC 
0x22224466 
0xDEDEA7 7 9 
0x494992DB 
0x919139A8 
0x8D8D018C 
Ox6565CAAF 
0xlClC3824 
0x4B4B96DD 
0x484890D8 
0x86861791 
0x6969D2BB 
0xCECE8749 
0xBFBF65DA 
OxBOB07BCB 



0x6B6BD6BD 
OxD7D7B562 
0x5959B2EB 
OxA4A453F7 
Ox3F3F7E41 
0xD8D8AB73 
0x969637Al 
0x27274E69 
0x6E6EDCB2 
0xE3E3DD3E 
OxFCFCE31F 
0x4C4C98D4 
0x4D4D9AD7 
0x3C3C7844 
0x9D9D21BC 
0xFFFFE51A 
0x979735A2 
Ox5D5DBAE7 
Ox2A2A547E 
Ox5E5EBCE2 
0x06060C0A 
0x959531A4 
OxD5D5B164 
0x7A7AF48E 
0xA6A657Fl 
0xBDBD61DC 
0x03030605 
0xClC19958 
0xD9D9A970 
Ox5555AAFF 
0xE6E6D731 
Ox5454A8FC 



0xB16F6FDE 
0xE6ABAB4D 
0xC947478E 
0x967272E4 
Ox02F7F7F5 
0x53313162 
OxOF05050A 
OxCDB2B27F 
0xEE5A5AB4 
Ox712F2F5E 
0xC8BlB179 
0xE85858B0 
0x55333366 
0xBA9F9F25 
0x48383870 
OxOEF3F3FD 
0xCC444488 
0x2B191932 
0xAB90903B 
0xlD0B0B16 
0x6C242448 
Ox37E4E4D3 
0xD24E4E9C 
0xE9AEAE47 
OxC7B4B473 
0x868B8B0D 
0x01F6F6F7 
Ox271DlD3A 
0x898E8E07 
0x78282850 
0xC6424284 
0xD6BBBB6D 



0x6F6FDEBl 
0xABAB4DE6 
0x47478EC9 
0x7272E496 
OxF7F7F502 
0x31316253 
Ox05050AOF 
0xB2B27FCD 
Ox5A5AB4EE 
Ox2F2F5E71 
0xBlB179C8 
0x5858B0E8 
0x33336655 
0x9F9F25BA 
0x38387048 
OxF3F3FDOE 
0x444488CC 
0xl919322B 
0x90903BAB 
0x0B0B161D 
0x2424486C 
0xE4E4D337 
0x4E4E9CD2 
0xAEAE47E9 
0xB4B473C7 
0x8B8B0D86 
0xF6F6F701 
OxlDlD3A27 
0x8E8E0789 
0x28285078 
0x424284C6 
0xBBBB6DD6 



Ox54C5C591, 
0x9A7676EC, 
OxOBFOFOFB, 
Ox5BCOC09B, 
0x4FCCCC83, 
Ox3F15152A, 
0xB59A9A2F, 
Ox9F7575EA, 
OxFBAOA05B, 
0x97848413, 
0xED5B5BB6, 
0x4ACFCF85, 
0x94858511, 
0xE3A8A84B, 
Ox04F5F5Fl, 
0x6DD2D2BF, 
0x3917172E, 
0x957373E6, 
0x8388880B, 
Ox7 6DBDBAD, 
OxE45C5CB8, 
0x8B7979F2, 
0xE0A9A949, 
0x18080810, 
0x51C6C697, 
0x858A8AOF, 
Oxl20EOElC, 
0xB99E9E27, 
0xA7949433, 
Ox7ADFDFA5, 
0xB86868D0, 
0x3A16162C 



OxC5C59154, 
0x7676EC9A, 
OxFOFOFBOB, 
0xC0C09B5B, 
0xCCCC834F, 
Oxl5152A3F, 
0x9A9A2FB5, 
0x7575EA9F, 
OxAOA05BFB, 
0x84841397, 
Ox5B5BB6ED, 
OxCFCF854A, 
0x85851194, 
0xA8A84BE3, 
OxF5F5F104, 
0xD2D2BF6D, 
0xl7172E39, 
Ox7373E695, 
0x88880B83, 
0xDBDBAD7 6, 
Ox5C5CB8E4, 
0x7979F28B, 
0xA9A949E0, 
0x08081018, 
0xC6C69751, 
0x8A8A0F85, 
OxOEOElC12, 
0x9E9E27B9, 
0x949433A7, 
0xDFDFA57A, 
0x6868DOB8, 
0xl6162C3A 



0x7CF8847C, 0x7 7EE 9977, 
0x01020301, 0x67CEA9 67, 
0x821F9D82,0xC98940C9, 
0xD4B367D4, OxA25FFDA2, 
OxFDEllCFD, 0x933DAE93, 



Ox7BF68D7B, OxF2FFODF2, 0x6BD6BD6B, 0x6FDEB16F, OxC59154C5, 
Ox2B567D2B, 0xFEE719FE, OxD7B562D7, 0xAB4DE6AB, 0x76EC9A76, 
Ox7DFA877D, OxFAEF15FA, Ox59B2EB59, 0x478EC947, OxFOFBOBFO, 
OxAF45EAAF, 0x9C23BF9C, OxA453F7A4, 0x72E49672, 0xC09B5BC0, 
0x264C6A26, 0x366C5A36, Ox3F7E413F, OxF7F502F7, 0xCC834FCC, 
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0x34685C34 

0x04080C04 

0x070E0907 

0x09121B09 

0x52A4F652 

0x53A6F553 

0x6AD4BE6A 

0xD0BB6BD0 

0x458ACF45 

0x51A2F351 

0xBC63DFBC 

0xCD814CCD 

0xC49357C4 

0x60C0A060 

0x468CCA46 

0xE0DB3BE0 

0xC29F5DC2 

0xE7D532E7 

0x6CD8B46C 

0xBA6FD5BA 

0xE8CB23E8 

0x70E09070 

0x61C2A361 

0xElD938El 

0x9B2DB69B 

0x8C038F8C 

0x4182C341 

}, 

{ 

0xC6A56363 

0x60503030 

0x8F45CACA 

0x41ECADAD 

0x75C2B7B7 

0x685C3434 

0x080C0404 

0x0E090707 

0xl21B0909 

0xA4F65252 

0xA6F55353 

0xD4BE6A6A 

0xBB6BD0D0 

0x8ACF4545 

0xA2F35151 

0x63DFBCBC 

0x814CCDCD 

0x9357C4C4 

0xC0A06060 

0x8CCA4646 

0xDB3BE0E0 

0x9F5DC2C2 

0xD532E7E7 

0xD8B46C6C 

0x6FD5BABA 

0xCB23E8E8 

0xE0907070 

0xC2A36161 

0xD938ElEl 

0x2DB69B9B 

0x038F8C8C 

0x82C34141 



0xA551F4A5 
0xC79552C7 
0x12243612 
0x831D9E83 
0x3B764D3B 
0xDlB968Dl 
0xCB8D46CB 
0xEFC52AEF 
OxF9E910F9 
0xA35DFEA3 
0xB677ClB6 
0x0C18140C 
0xA755F2A7 
0x81199881 
0xEEC729EE 
0x32645632 
0xD3BD6ED3 
0xC88B43C8 
0x5 6ACFA5 6 
0x78F08878 
0xDDA17CDD 
0x3E7C423E 
0x356A5F35 
0xF8EB13F8 
0xlE3C221E 
0xA159F8Al 
0x9929B099 



0xF8847C7C 
0x02030101 
0xlF9D8282 
0xB367D4D4 
OxEllCFDFD 
0x51F4A5A5 
0x9552C7C7 
0x24361212 
0xlD9E8383 
0x764D3B3B 
0xB968DlDl 
0x8D46CBCB 
0xC52AEFEF 
0xE910F9F9 
0x5DFEA3A3 
0x77ClB6B6 
0xl8140C0C 
0x55F2A7A7 
0x19988181 
0xC72 9EEEE 
0x64563232 
0xBD6ED3D3 
0x8B43C8C8 
0xACFA5 65 6 
0xF0887878 
0xA17CDDDD 
0x7C423E3E 
0x6A5F3535 
0xEB13F8F8 
0x3C221ElE 
0x59F8AlAl 
0x29B09999 



0xE5D134E5 
0x23466523 
0x801B9B80 
0x2C58742C 
0xD6B761D6 
0000000000 
0xBE67D9BE 
0xAA4FE5AA 
0x02040602 
0x4080C040 
0xDAAF75DA 
0x13263513 
0x7EFC827E 
0x4F9ED14F 
0xB86BD3B8 
0x3A744E3A 
0xAC43EFAC 
0x376E5937 
0xF4F307F4 
0x254A6F25 
0x74E89C74 
0xB571C4B5 
0x57AEF957 
0x982BB398 
0x87159287 
0x89098089 
0x2D5A772D 



0xEE997777 
0xCEA96767 
0x8940C9C9 
0x5FFDA2A2 
0x3DAE9393 
0xD134E5E5 
0x46652323 
0xlB9B8080 
0x58742C2C 
0xB761D6D6 
0000000000 
0x67D9BEBE 
0x4FE5AAAA 
0x04060202 
0x80C04040 
0xAF7 5DADA 
0x26351313 
0xFC827E7E 
0x9ED14F4F 
0x6BD3B8B8 
0x744E3A3A 
0x43EFACAC 
0x6E593737 
0xF307F4F4 
0x4A6F2525 
0xE89C7474 
0x71C4B5B5 
0xAEF95757 
0x2BB39898 
0x15928787 
0x09808989 
0x5A772D2D 



0xFlF908Fl 
0xC39D5EC3 
0xE2DF3DE2 
0xlA342ElA 
0xB37DCEB3 
0xEDC12CED 
0x39724B39 
0xFBED16FB 
0x7FFE817F 
0x8F058A8F 
0x21426321 
0xECC32FEC 
0x3D7A473D 
0xDCA37FDC 
0xl4283C14 
0x0A141E0A 
0x62C4A662 
0x6DDAB76D 
0xEACF25EA 
0x2E5C722E 
0xlF3E211F 
0x66CCAA66 
0xB969D0B9 
0x11223311 
0xE9C920E9 
0x0DlA170D 
OxOFlEllOF 



0xF68D7B7B 
0x567D2B2B 
0xFA877D7D 
0x4 5EAAFAF 
0x4C6A2626 
0xF908FlFl 
0x9D5EC3C3 
0xDF3DE2E2 
0x342E1A1A 
0x7DCEB3B3 
0xC12CEDED 
0x724B3939 
0xED16FBFB 
0xFE817F7F 
0x058A8F8F 
0x42632121 
0xC32FECEC 
0x7A473D3D 
0xA37FDCDC 
0x283C1414 
0xl41E0A0A 
0xC4A66262 
0xDAB7 6D6D 
0xCF25EAEA 
0x5C722E2E 
0x3E211FlF 
0xCCAA6666 
0x69D0B9B9 
0x22331111 
0xC920E9E9 
0xlA170D0D 
OxlEllOFOF 



0x71E29371 
0x18302818 
0xEBCD2 6EB 
0xlB362DlB 
0x29527B29 
0x20406020 
0x4A94DE4A 
0x4386C543 
Ox50AOF050 
0x923FAD92 
0x10203010 
Ox5FBEE15F 
0x64C8AC64 
0x22446622 
0xDEA77 9DE 
0x4992DB49 
0x9139A891 
0x8D018C8D 
0x65CAAF65 
0xlC38241C 
0x4B96DD4B 
0x4890D848 
0x86179186 
0x69D2BB69 
0xCE8749CE 
0xBF65DABF 
0xB07BCBB0 



OxFFODF2F2 
0xE719FEFE 
OxEF15FAFA 
0x23BF9C9C 
0x6C5A3636 
0xE2937171 
0x30281818 
0xCD26EBEB 
0x362D1B1B 
0x527B2929 
0x40602020 
0x94DE4A4A 
0x86C54343 
OxAOF05050 
0x3FAD9292 
0x20301010 
OxBEE15F5F 
0xC8AC6464 
0x44662222 
0xA779DEDE 
0x92DB4949 
0x39A89191 
0x018C8D8D 
0xCAAF6565 
0x38241ClC 
0x96DD4B4B 
0x90D84848 
0x17918686 
0xD2BB6969 
0x8749CECE 
Ox65DABFBF 
0x7BCBB0B0 



0xD8AB73D8 
0x9637A196 
0x274E6927 
0x6EDCB26E 
OxE3DD3EE3 
OxFCE31FFC 
0x4C98D44C 
0x4D9AD74D 
0x3C78443C 
0x9D21BC9D 
0xFFE51AFF 
0x9735A297 
Ox5DBAE75D 
0x2A547E2A 
0x5EBCE25E 
0x060C0A06 
Ox9531A495 
OxD5B164D5 
0x7AF48E7A 
0xA657FlA6 
0xBD61DCBD 
0x03060503 
0xC19958Cl 
0xD9A970D9 
Ox55AAFF55 
0xE6D731E6 
0x54A8FC54 



0xD6BD6B6B 
OxB562D7D7 
0xB2EB5959 
Ox53F7A4A4 
0x7E413F3F 
0xAB73D8D8 
0x37A19696 
0x4E692727 
0xDCB26E6E 
OxDD3EE3E3 
OxE31FFCFC 
0x98D44C4C 
0x9AD74D4D 
0x78443C3C 
0x21BC9D9D 
OxE51AFFFF 
0x35A29797 
OxBAE75D5D 
Ox547E2A2A 
0xBCE25E5E 
0x0C0A0606 
Ox31A49595 
0xB164D5D5 
0xF48E7A7A 
0x57FlA6A6 
0x61DCBDBD 
0x06050303 
0x9958ClCl 
0xA970D9D9 
0xAAFF5555 
0xD731E6E6 
OxA8FC5454 



0x31625331 

Ox050AOF05 
0xB27FCDB2 
Ox5AB4EE5A 
Ox2F5E712F 
0xB179C8Bl 
0x58B0E858 
0x33665533 
0x9F25BA9F 
0x38704838 
0xF3FD0EF3 
0x4488CC44 
0xl9322B19 
0x903BAB90 
0x0B161D0B 
0x24486C24 
OxE4D337E4 
0x4E9CD24E 
0xAE47E9AE 
OxB473C7B4 
0x8B0D868B 
0xF6F701F6 
OxlD3A271D 
0x8E07898E 
0x28507828 
0x4284C642 
0xBB6DD6BB 



0xDEB16F6F 
0x4DE6ABAB 
0x8EC94747 
0xE4967272 
OxF502F7F7 
0x62533131 
OxOAOF0505 
0x7FCDB2B2 
OxB4EE5A5A 
Ox5E712F2F 
0x79C8BlBl 
0xB0E85858 
0x66553333 
0x25BA9F9F 
0x70483838 
0xFD0EF3F3 
0x88CC4444 
0x322B1919 
0x3BAB9090 
0xl61D0B0B 
0x486C2424 
OxD337E4E4 
0x9CD24E4E 
0x47E9AEAE 
Ox73C7B4B4 
0x0D868B8B 
0xF701F6F6 
Ox3A271DlD 
0x07898E8E 
0x50782828 
0x84C64242 
0x6DD6BBBB 



0xl52A3F15, 

0x9A2FB59A, 
Ox75EA9F75, 
OxA05BFBAO, 
0x84139784, 
0x5BB6ED5B, 
OxCF854ACF, 
0x85119485, 
0xA84BE3A8, 
OxF5F104F5, 
0xD2BF6DD2, 
0xl72E3917, 
0x73E69573, 
0x880B8388, 
0xDBAD7 6DB, 
Ox5CB8E45C, 
0x79F28B79, 
0xA949E0A9, 
0x08101808, 
0xC69751C6, 
0x8A0F858A, 
OxOElC120E, 
0x9E27B99E, 
0x9433A794, 
OxDFA57ADF, 
0x68D0B868, 
0xl62C3A16 



Ox9154C5C5, 
0xEC9A7676, 
OxFBOBFOFO, 
0x9B5BC0C0, 
0x834FCCCC, 
Ox2A3F1515, 
0x2FB59A9A, 
0xEA9F7575, 
Ox5BFBA0A0, 
0x13978484, 
OxB6ED5B5B, 
0x854ACFCF, 
0x11948585, 
0x4BE3A8A8, 
OxF104F5F5, 
0xBF6DD2D2, 
0x2E391717, 
0xE6957373, 
0x0B838888, 
0xAD7 6DBDB, 
0xB8E45C5C, 
0xF28B7979, 
0x49E0A9A9, 
0x10180808, 
0x9751C6C6, 
0x0F858A8A, 
0xlC120EOE, 
Ox27B99E9E, 
0x33A79494, 
OxA57ADFDF, 
0xD0B86868, 
0x2C3A1616 



}; 



stati 

{ 
{ 

0x00 
0x00 
0x00 
0x00 
0x00 
0x00 
0x00 
0x00 
0x00 
0x00 
0x00 



c u32 fl_tab[4] [256] 



000063, 
000030, 
OOOOCA, 
OOOOAD, 
0000B7, 
000034, 
000004, 
000007, 
000009, 
000052, 
000053, 



0x0000 
0x0000 
0x0000 
0x0000 
0x0000 
0x0000 
0x0000 
0x0000 
0x0000 
0x0000 
0x0000 



007C, 
0001, 
0082, 
00D4, 
OOFD, 
0A5, 
00C7, 
0012, 
0083, 
003B, 
00D1, 



0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 



00077, 
00067, 
000C9, 
0A2, 
00093, 
000E5, 
00023, 
00080, 
0002C, 
000D6, 
00000, 



0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 



0007B, 

0002B, 
0007D, 
OAF, 
00026, 
000F1, 
000C3, 
000E2, 
0001A, 
000B3, 
OOOED, 



0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 



000F2, 
OOOFE, 
OOOFA, 
0009C, 
00036, 
00071, 
00018, 
OOOEB, 
0001B, 
00029, 
00020, 



0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 



0006B 
000D7 
00059 
0A4 
0003F 
000D8 
00096 
00027 
0006E 
000E3 
OOOFC 



0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 



0006F, 

OOOAB, 
00047, 
00072, 
000F7, 
00031, 
00005, 
000B2, 
0005A, 
0002F, 
000B1, 



0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 



000C5, 

00076, 
OOOFO, 
OOOCO, 
OOOCC, 
00015, 
000 9A, 
00075, 
OOOAO, 
00084, 
0005B, 
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0x0000006A 

OxOOOOOODO 

0x00000045 

0x00000051 

OxOOOOOOBC 

OxOOOOOOCD 

0x000000C4 

0x00000060 

0x00000046 

OxOOOOOOEO 

0x000000C2 

OxOOOOOOE7 

0x0000006C 

OxOOOOOOBA 

0x000000E8 

0x00000070 

0x00000061 

OxOOOOOOEl 

0x0000009B 

0x0000008C 

0x00000041 

}, 

{ 

0x00006300 

0x00003000 

OxOOOOCAOO 

OxOOOOADOO 

OxOOOOB700 

0x00003400 

0x00000400 

0x00000700 

0x00000900 

0x00005200 

0x00005300 

0x00006A00 

OxOOOODOOO 

0x00004500 

0x00005100 

OxOOOOBCOO 

OxOOOOCDOO 

0x0000C400 

0x00006000 

0x00004600 

OxOOOOEOOO 

0x0000C200 

OxOOOOE700 

0x00006C00 

OxOOOOBAOO 

0x0000E800 

0x00007000 

0x00006100 

OxOOOOElOO 

0x00009B00 

0x00008C00 

0x00004100 

}, 

{ 

0x00630000 

0x00300000 

OxOOCAOOOO 

OxOOADOOOO 

OxOOB70000 

0x00340000 

0x00040000 

0x00070000 

0x00090000 

0x00520000 

0x00530000 

0x006A0000 

OxOODOOOOO 

0x00450000 

0x00510000 

OxOOBCOOOO 

OxOOCDOOOO 

0x00C40000 

0x00600000 

0x00460000 

OxOOEOOOOO 



0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 



OOOCB 
OOOEF 

000F9 
0A3 
000B6 
OOOOC 
0A7 
00081 
OOOEE 
00032 
000D3 
000C8 
00056 
00078 
OOODD 
0003E 
00035 
000F8 
0001E 
0A1 
00099 



0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 



07C00 
00100 
08200 
0D400 
OFDOO 
0A500 
0C700 
01200 
08300 
03B00 
0D100 
OCBOO 
OEFOO 
0F900 
0A300 
0B600 
OOCOO 
0A7 
08100 
OEEOO 
03200 
0D300 
0C800 
05600 
07800 
ODDOO 
03E00 
03500 
0F800 
01E00 
0A10 
09900 



0x007C0000 
0x00010000 
0x00820000 
0x00D40000 
OxOOFDOOOO 
OxOOA50000 
OxOOC70000 
0x00120000 
0x00830000 
Ox003BOOOO 
OxOODlOOOO 
OxOOCBOOOO 
OxOOEFOOOO 
0x00F90000 
OxOOA30000 
0x00B60000 
OxOOOCOOOO 
0x00A70000 
0x00810000 
OxOOEEOOOO 
0x00320000 



0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 



OOOBE 
OOOAA 
00002 
00040 
OOODA 
00013 
0007E 
0004F 
000B8 
0003A 
OOOAC 
00037 
000F4 
00025 
00074 
000B5 
00057 
00098 
00087 
00089 
0002D 



0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
00000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 



07700 
06700 
0C900 
0A2 
09300 
0E500 
02300 
08000 
02C00 
0D600 
00000 
OBEOO 
OAAOO 
00200 
04000 
ODAOO 
01300 
07E00 
04F00 
0B800 
03A0 
OACOO 
03700 
0F400 
02500 
07400 
0B500 
05700 
09800 
08700 
08900 
02D00 



0x00770000 
0x00670000 
0x00C90000 
0x00A20000 
0x00930000 
OxOOE50000 
0x00230000 
0x00800000 
0x002C0000 
0x00D60000 
0000000000 
OxOOBEOOOO 
OxOOAAOOOO 
0x00020000 
0x00400000 
OxOODAOOOO 
0x00130000 
0x007E0000 
0x004F0000 
0x00B80000 
0x003A0000 



0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 



00039 

OOOFB 
0007F 
0008F 
00021 
OOOEC 
0003D 
OOODC 
00014 
OOOOA 
00062 
0006D 
OOOEA 
0002E 
0001F 
00066 
000B9 
00011 
000E9 
OOOOD 
OOOOF 



0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 



07B00 

02B00 
07D00 
OAF 
02600 
0F100 
0C300 
0E200 
01A0 
0B300 
OEDOO 
03900 
OFBOO 
07F00 
08F00 
02100 
OECOO 
03D00 
ODCOO 
01400 
OOAOO 
06200 
06D00 
OEAOO 
02E00 
01F00 
06600 
0B900 
01100 
0E900 
OODOO 
OOFOO 



0x007B0000 
0x002B0000 
Ox007DOOOO 
OxOOAFOOOO 
0x00260000 
OxOOFlOOOO 
OxOOC30000 
0x00E20000 
OxOOlAOOOO 
OxOOB30000 
OxOOEDOOOO 
0x00390000 
OxOOFBOOOO 
0x007F0000 
0x008F0000 
0x00210000 
OxOOECOOOO 
Ox003DOOOO 
OxOODCOOOO 
0x00140000 
OxOOOAOOOO 



0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 



0004A 
00043 
00050 
00092 
00010 
0005F 
00064 
00022 
OOODE 
00049 
00091 
0008D 
00065 
0001C 
0004B 
00048 
00086 
00069 
OOOCE 
OOOBF 
OOOBO 



0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 



0F200 

OFEOO 
OFAOO 
09C00 
03600 
07100 
01800 
OEBOO 
01B00 
02900 
02000 
04A00 
04300 
05000 
09200 
01000 
05F00 
06400 
02200 
ODEOO 
04900 
09100 
08D00 
06500 
01C00 
04B00 
04800 
08600 
06900 
OCEOO 
OBFOO 
OBOOO 



0x00F20000 

OxOOFEOOOO 
OxOOFAOOOO 
0x009C0000 
0x00360000 
0x00710000 
0x00180000 
OxOOEBOOOO 
OxOOlBOOOO 
0x00290000 
0x00200000 
0x004A0000 
0x00430000 
0x00500000 
0x00920000 
0x00100000 
Ox005FOOOO 
0x00640000 
0x00220000 
OxOODEOOOO 
0x00490000 



0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 



0004C, 
0004D, 
0003C, 
0009D, 
OOOFF, 
00097, 
0005D, 
0002A, 
0005E, 
00006, 
00095, 
000D5, 
0007A, 
000A6, 
OOOBD, 
00003, 
000C1, 
000D9, 
00055, 
000E6, 
00054, 



0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 



00058 

00033 
0009F 
00038 
000F3 
00044 
00019 
00090 
OOOOB 
00024 
000E4 
0004E 
OOOAE 
000B4 
0008B 
000F6 
0001D 
0008E 
00028 
00042 
OOOBB 



0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 



06B00 
0D700 
05900 
0A400 
03F00 
0D800 
09600 
02700 
06E00 
0E300 
OFCOO 
04C00 
04D00 
03C00 
09D00 
OFFOO 
09700 
05D00 
02A00 
05E00 
00600 
09500 
0D500 
07A00 
0A600 
OBDOO 
00300 
0C100 
0D900 
05500 
0E600 
05400 



0x006B0000 
OxOOD70000 
0x00590000 
0x00A40000 
Ox003FOOOO 
0x00D80000 
0x00960000 
0x00270000 
0x006E0000 
OxOOE30000 
OxOOFCOOOO 
0x004C0000 
0x004D0000 
Ox003COOOO 
0x009D0000 
OxOOFFOOOO 
0x00970000 
Ox005DOOOO 
0x002A0000 
Ox005EOOOO 
0x00060000 



0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 



06F00 
OABOO 
04700 
07200 
0F700 
03100 
00500 
0B200 
05A0 
02F00 
0B100 
05800 
03300 
09F00 
03800 
0F300 
04400 
01900 
09000 
OOBOO 
02400 
0E400 
04E00 
OAEOO 
0B400 
08B00 
0F600 
01D00 
08E00 
02800 
04200 
OBBOO 



0x006F0000 
OxOOABOOOO 
0x00470000 
0x00720000 
OxOOF70000 
0x00310000 
0x00050000 
0x00B20000 
Ox005AOOOO 
0x002F0000 
OxOOBlOOOO 
0x00580000 
0x00330000 
0x009F0000 
0x00380000 
OxOOF30000 
0x00440000 
0x00190000 
0x00900000 
OxOOOBOOOO 
0x00240000 



0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 



OOOCF, 

00085, 
0A8, 
000F5, 
000D2, 
00017, 
00073, 
00088, 
OOODB, 
0005C, 
00079, 
000A9, 
00008, 
000C6, 
0008A, 
OOOOE, 
0009E, 
00094, 
OOODF, 
00068, 
00016 



0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 
0x000 



0C500, 
07600, 
OFOOO, 
OCOOO, 
OCCOO, 
01500, 
9A0 0, 
07500, 
OAOOO, 
08400, 
05B00, 
OCFOO, 
08500, 
0A800, 
0F500, 
0D200, 
01700, 
07300, 
08800, 
ODBOO, 
05C00, 
07900, 
0A900, 
00800, 
0C600, 
8A0 0, 
OOEOO, 
09E00, 
09400, 
ODFOO, 
06800, 
01600 



OxOOC50000 

0x00760000 
OxOOFOOOOO 
OxOOCOOOOO 
OxOOCCOOOO 
0x00150000 
0x009A0000 
0x00750000 
OxOOAOOOOO 
0x00840000 
Ox005BOOOO 
OxOOCFOOOO 
0x00850000 
0x00A80000 
OxOOF50000 
0x00D20000 
0x00170000 
0x00730000 
0x00880000 
OxOODBOOOO 
Ox005COOOO 
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0x00C20000 


0x00D30000 


OxOOACOOOO 


0x00620000 


0x00910000 


0x00950000 


OxOOE40000 


0x00790000 


0x00E70000 


0x00C80000 


0x00370000 


0x006D0000 


0x008D0000 


OxOOD50000 


0x004E0000 


0x00A90000 


0x006C0000 


0x00560000 


0x00F40000 


OxOOEAOOOO 


0x00650000 


0x007A0000 


OxOOAEOOOO 


0x00080000 


OxOOBAOOOO 


0x00780000 


0x00250000 


0x002E0000 


OxOOlCOOOO 


0x00A60000 


0x00B40000 


0x00C60000 


0x00E80000 


OxOODDOOOO 


0x00740000 


OxOOlFOOOO 


0x004B0000 


OxOOBDOOOO 


0x008B0000 


0x008A0000 


0x00700000 


Ox003EOOOO 


OxOOB50000 


0x00660000 


0x00480000 


0x00030000 


0x00F60000 


OxOOOEOOOO 


0x00610000 


0x00350000 


0x00570000 


0x00B90000 


0x00860000 


OxOOClOOOO 


OxOOlDOOOO 


0x009E0000 


OxOOElOOOO 


0x00F80000 


0x00980000 


0x00110000 


0x00690000 


0x00D90000 


0x008E0000 


0x00940000 


0x009B0000 


OxOOlEOOOO 


0x00870000 


0x00E90000 


OxOOCEOOOO 


0x00550000 


0x00280000 


OxOODFOOOO 


0x008C0000 


OxOOAlOOOO 


0x00890000 


OxOOODOOOO 


OxOOBFOOOO 


0x00E60000 


0x00420000 


0x00680000 


0x00410000 
}, 


0x00990000 


0x002D0000 


OxOOOFOOOO 


OxOOBOOOOO 


0x00540000 


OxOOBBOOOO 


0x00160000 


{ 

0x63000000 


0x7C000000 


0x77000000 


Ox7BOOOOOO 


0xF2000000 


0x6B000000 


0x6F000000 


OxC5000000 


0x30000000 


0x01000000 


0x67000000 


0x2B000000 


OxFEOOOOOO 


OxD7000000 


OxABOOOOOO 


0x76000000 


OxCAOOOOOO 


0x82000000 


0xC9000000 


Ox7DOOOOOO 


OxFAOOOOOO 


0x59000000 


0x47000000 


OxFOOOOOOO 


OxADOOOOOO 


0xD4000000 


0xA2000000 


OxAFOOOOOO 


0x9C000000 


0xA4000000 


0x72000000 


OxCOOOOOOO 


OxB7000000 


OxFDOOOOOO 


0x93000000 


0x26000000 


0x36000000 


Ox3FOOOOOO 


OxF7000000 


OxCCOOOOOO 


0x34000000 


OxA5000000 


OxE5000000 


OxFlOOOOOO 


0x71000000 


0xD8000000 


0x31000000 


0x15000000 


0x04000000 


0xC7000000 


0x23000000 


OxC3000000 


0x18000000 


0x96000000 


0x05000000 


0x9A000000 


0x07000000 


0x12000000 


0x80000000 


0xE2000000 


OxEBOOOOOO 


0x27000000 


0xB2000000 


0x75000000 


0x09000000 


0x83000000 


0x2C000000 


OxlAOOOOOO 


OxlBOOOOOO 


0x6E000000 


Ox5AOOOOOO 


OxAOOOOOOO 


0x52000000 


Ox3BOOOOOO 


0xD6000000 


OxB3000000 


0x29000000 


OxE3000000 


Ox2FOOOOOO 


0x84000000 


0x53000000 


OxDIOOOOOO 


0000000000 


OxEDOOOOOO 


0x20000000 


OxFCOOOOOO 


OxBlOOOOOO 


Ox5BOOOOOO 


0x6A000000 


OxCBOOOOOO 


OxBEOOOOOO 


0x39000000 


0x4A000000 


0x4C000000 


0x58000000 


OxCFOOOOOO 


OxDOOOOOOO 


OxEFOOOOOO 


OxAAOOOOOO 


OxFBOOOOOO 


0x43000000 


0x4D000000 


0x33000000 


0x85000000 


0x45000000 


0xF9000000 


0x02000000 


Ox7FOOOOOO 


0x50000000 


Ox3COOOOOO 


0x9F000000 


0xA8000000 


0x51000000 


OxA3000000 


0x40000000 


0x8F000000 


0x92000000 


0x9D000000 


0x38000000 


OxF5000000 


OxBCOOOOOO 


0xB6000000 


OxDAOOOOOO 


0x21000000 


0x10000000 


OxFFOOOOOO 


OxF3000000 


0xD2000000 


OxCDOOOOOO 


OxOCOOOOOO 


0x13000000 


OxECOOOOOO 


Ox5FOOOOOO 


0x97000000 


0x44000000 


0x17000000 


0xC4000000 


OxA7000000 


Ox7EOOOOOO 


Ox3DOOOOOO 


0x64000000 


Ox5DOOOOOO 


0x19000000 


0x73000000 


0x60000000 


0x81000000 


0x4F000000 


OxDCOOOOOO 


0x22000000 


0x2A000000 


0x90000000 


0x88000000 


0x46000000 


OxEEOOOOOO 


0xB8000000 


0x14000000 


OxDEOOOOOO 


Ox5EOOOOOO 


OxOBOOOOOO 


OxDBOOOOOO 


OxEOOOOOOO 


0x32000000 


Ox3AOOOOOO 


OxOAOOOOOO 


0x49000000 


0x06000000 


0x24000000 


Ox5COOOOOO 


0xC2000000 


OxD3000000 


OxACOOOOOO 


0x62000000 


0x91000000 


0x95000000 


0xE4000000 


0x79000000 


OxE7000000 


0xC8000000 


0x37000000 


0x6D000000 


0x8D000000 


OxD5000000 


0x4E000000 


0xA9000000 


0x6C000000 


0x56000000 


OxF4000000 


OxEAOOOOOO 


0x65000000 


0x7A000000 


OxAEOOOOOO 


0x08000000 


OxBAOOOOOO 


0x78000000 


0x25000000 


0x2E000000 


OxlCOOOOOO 


0xA6000000 


0xB4000000 


0xC6000000 


0xE8000000 


OxDDOOOOOO 


0x74000000 


OxlFOOOOOO 


Ox4BOOOOOO 


OxBDOOOOOO 


0x8B000000 


0x8A000000 


0x70000000 


Ox3EOOOOOO 


OxB5000000 


0x66000000 


0x48000000 


0x03000000 


0xF6000000 


OxOEOOOOOO 


0x61000000 


0x35000000 


0x57000000 


0xB9000000 


0x86000000 


OxClOOOOOO 


OxlDOOOOOO 


0x9E000000 


OxElOOOOOO 


0xF8000000 


0x98000000 


0x11000000 


0x69000000 


0xD9000000 


0x8E000000 


0x94000000 


0x9B000000 


OxlEOOOOOO 


0x87000000 


0xE9000000 


OxCEOOOOOO 


0x55000000 


0x28000000 


OxDFOOOOOO 


0x8C000000 


OxAlOOOOOO 


0x89000000 


OxODOOOOOO 


OxBFOOOOOO 


0xE6000000 


0x42000000 


0x68000000 


0x41000000 


0x99000000 


0x2D000000 


OxOFOOOOOO 


OxBOOOOOOO 


0x54000000 


OxBBOOOOOO 


0x16000000 



}; 



The workspace 



static u32 Ekey [44] , 



/* The expanded key */ 



/* The round Function. 

#define f__rnd(x, n) 

( ft_tab[0] [byteO (x[n] ) ] 
A ft_tab[l] [bytel (x[ (n + 1) 
A ft_tab[2] [byte2 (x[ (n + 2) 
A ft_tab[3] [byte3 (x[ (n + 3) 



4 table lookups and 4 Exors 



-*/ 



3:; 
3:: 
3:: 



#define f_round(bo, bi, 



k) 



bo[0] 
bo[l] 
bo [2] 
bo [3] 

k += • 



f_rnd(bi, 0) 

f_rnd(bi, 1) 

f_rnd(bi, 2) 

f_rnd(bi, 3) 



k[0] 
k[l] 
k[2] 
k[3] 



/* The S Box lookup used in constructing the Key schedule */ 

#define ls_box(x) \ 

( fl_tab[0] [byteO (x) ] \ 

A fl_tab[l] [bytel (x) ] \ 

A fl_tab[2] [byte2 (x) ] \ 

A fl_tab[3] [byte3 (x) ] ) 



/* The last round function (no MixColumn) 

#define lf_rnd(x, n) \ 

( fl_tab[0] [byteO (x[n] ) ] \ 

A fl_tab[l] [bytel (x[ (n + 1) & 3])] \ 

A fl_tab[2] [byte2 (x[ (n + 2) & 3])] \ 
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fl_tab[3] [byte3(x[ (n + 3) & 3] ) ] ) 



/* 

* Ri jndaelKeySchedule 

* Initialise the key schedule from a supplied key 
*/ 

void Ri jndaelKeySchedule (u8 key [16]) 
{ 

u32 t; 

u32 *ek=Ekey, /* pointer to the expanded key */ 
*rc=rnd_con; /* pointer to the round constant */ 



Ekey[0] = u32_in (key ) 

Ekey[l] = u32_in(key + 4) 

Ekey[2] = u32_in(key + 8) 

Ekey[3] = u32_in(key + 12) 



while (ek < Ekey + 40) 

{ 

t = rot3 (ek[3] ) ; 

ek[4] = ek[0] A ls_box(t) 

ek[5] = ek[l] A ek[4] , 

ek[6] = ek[2] A ek[5] , 

ek[7] = ek[3] A ek[6] , 
ek += 4; 

} 



*rc++; 



/*- 



* Ri jndaelEncrypt 

* Encrypt an input block 
*/ 

void Ri jndaelEncrypt (u8 in [16], u8 out [If 
{ 

u32 b0[4], bl[4], *kp = Ekey; 

b0[0] = u32_.in(in ) A *kp++; 

bO[l] = u32_in(in + 4 ) A *kp++; 

b0[2] = u32_in(in + 8 ) A *kp++; 

b0[3] = u32_in(in + 12) A *kp++; 



f 


jround (bl, 


bO, 


kp 


f. 


.round (bO, 


bl. 


kp 


f. 


.round (bl, 


bO, 


kp 


f. 


.round (bO, 


bl. 


kp 


f 


.round (bl, 


bO, 


kp 


f. 


.round (bO, 


bl. 


kp 


f. 


.round (bl, 


bO, 


kp 


f. 


.round (bO, 


bl. 


kp 


f. 


.round (bl, 


bO, 


kp 



u32_out(out, lf_rnd(bl, 0) ~ kp [ ] 

u32_out(out + 4, lf_rnd(bl, 1) ~ kp [ 1 ] 

u32_out(out + 8, lf_rnd(bl, 2) ~ kp[2] 

u32„out(out + 12, lf_rnd(bl, 3) A kp[3] 
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Annex A (informative): 
Change history 



Change history 
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CR 
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Approved as Release 1 999 


SP-11 
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- 


4.0.0 


Updated to Release 4 
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